In her State of the Union address delivered in Strasbourg on 16 September 2026, the President of the European Commission announced that a proposal for a regulation dedicated to the protection of minors online, the "EU Kids Act", would be tabled on 17 September. The official text has not yet been published and the analysis below is based on a working version of the proposal. What is already clear is the change of scale: where national initiatives were multiplying in a scattered fashion, the Commission has opted for the most binding instrument available under EU law, a directly applicable regulation.
1. A response to national fragmentation
France led the way with its law of 7 July 2023 establishing a digital age of majority at 15, which has remained inapplicable for want of compatibility with EU law, before notifying the Commission of a new bill banning social media for under-15s. Italy, Greece, Austria, Poland, Belgium and Denmark have taken comparable steps, while the European Parliament called in November 2025 for a harmonised digital age of majority at 16 and 25 Member States signed the Jutland Declaration in October 2025 in support of age verification.
The Commission, which had until now confined itself to guidelines on Article 28 of the DSA, is drawing the consequences of this momentum: according to the draft, it would convert those guidelines into hard law and set a single age for the whole internal market.
2. A broad scope
Based on the leaked draft, the regulation would apply, irrespective of their place of establishment, to providers of online social networking services, video-sharing platforms, app stores, online games and operating systems, as well as to AI companions and general conversational chatbots accessible to minors. It would dovetail with the DSA (whose Article 28 it would specify, with a presumption of compliance for platforms meeting its requirements) and with the AI Act, from which it would borrow the supervision and sanction regime for AI systems, with fines of up to 6% of worldwide turnover.
The final scope, and in particular the treatment of online games and AI systems, is one of the points most likely to evolve between the leaked version and the official text.
3. Two age thresholds, two rationales
The two-tier structure was expressly confirmed by the Commission President in her address.
Below the age of 13, the ban would be the rule: no account could be created on a social network or video-sharing platform. The sole, tightly framed exception contemplated in the draft is guardian-controlled access to certain video-sharing platforms specifically designed for young children, exclusively through the parent's own account, with no account for the child, usage capped at one hour per day and recommendation and search features switched off.
Between 13 and 15, the text would not prohibit but condition: the minor could not hold an autonomous personal account, but a parent could open a limited-feature account on their behalf, with parental tools permanently activated, a one-hour daily cap and prior approval of new contacts.
From 15 onwards, access would be unrestricted, but subject to the safety by design regime. The whole mechanism would rest on mandatory age verification, which, under the draft, would have to rely exclusively on solutions certified against the forthcoming EU Age Verification Scheme (the European Digital Identity Wallet being deemed compliant), with existing accounts to be reviewed within six months of the date of application.
The precise modalities of age verification and the related deadlines should be treated as indicative pending the official text.
4. Safety by design as an obligation of result
Beyond the age thresholds, the draft regulation would require all services in scope to ensure a high level of privacy, safety and security for minors, by default and for all users under 18, with the burden of proof reversed: it would be for the provider to establish that a user is an adult before departing from those requirements.
The Commission President explicitly referred to this reversal in her address. According to the draft, the text would expressly prohibit addictive design (autoplay, uninterrupted scrolling, unsolicited notifications, engagement rewards), regulate recommender systems, impose protective default settings, restrict contact with strangers, secure transactions and ban variable reward mechanisms. Specific obligations would be laid down for AI companions and chatbots, video games and app stores, complemented by child-friendly reporting tools, parental tools and a right to lodge collective complaints.
The detailed list of prohibited features and the sector-specific obligations are subject to confirmation.
5. What next?
At this stage, the text is only a proposal, and one whose exact wording Hogan Lovells Cadwalader has yet to see. Once formally adopted by the Commission, it will enter the ordinary legislative procedure and be negotiated between the European Parliament and the Council, where positions already diverge on the pivotal age (15 or 16) and on the breadth of the scope.
Adoption before 2028 appears unlikely. The announcement is nonetheless a strong political signal: the Commission now openly embraces a European model for the protection of minors online, distinct from the Australian approach, and Member States that had launched national legislation will have to align with this harmonised framework.
Hogan Lovells Cadwalader will provide more insights and further analysis once the official proposal is published.
Authors:
- Etienne Drouard, Partner at Hogan Lovells Cadwalader
- Rémy Schlich, Senior Associate at Hogan Lovells Cadwalader
